--- /dev/null
+/*
+ * Galois/Counter Mode (GCM) and GMAC with AES-128
+ *
+ * Copyright (c) 2012, Jouni Malinen <j@w1.fi>
+ *
+ * This software may be distributed under the terms of the BSD license.
+ * See README for more details.
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "aes.h"
+#include "aes_wrap.h"
+
+static void inc32(u8 *block)
+{
+ u32 val;
+ val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
+ val++;
+ WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
+}
+
+
+static void xor_block(u8 *dst, const u8 *src)
+{
+ u32 *d = (u32 *) dst;
+ u32 *s = (u32 *) src;
+ *d++ ^= *s++;
+ *d++ ^= *s++;
+ *d++ ^= *s++;
+ *d++ ^= *s++;
+}
+
+
+static void shift_right_block(u8 *v)
+{
+ u32 val;
+
+ val = WPA_GET_BE32(v + 12);
+ val >>= 1;
+ if (v[11] & 0x01)
+ val |= 0x80000000;
+ WPA_PUT_BE32(v + 12, val);
+
+ val = WPA_GET_BE32(v + 8);
+ val >>= 1;
+ if (v[7] & 0x01)
+ val |= 0x80000000;
+ WPA_PUT_BE32(v + 8, val);
+
+ val = WPA_GET_BE32(v + 4);
+ val >>= 1;
+ if (v[3] & 0x01)
+ val |= 0x80000000;
+ WPA_PUT_BE32(v + 4, val);
+
+ val = WPA_GET_BE32(v);
+ val >>= 1;
+ WPA_PUT_BE32(v, val);
+}
+
+
+/* Multiplication in GF(2^128) */
+static void gf_mult(const u8 *x, const u8 *y, u8 *z)
+{
+ u8 v[16];
+ int i, j;
+
+ os_memset(z, 0, 16); /* Z_0 = 0^128 */
+ os_memcpy(v, y, 16); /* V_0 = Y */
+
+ for (i = 0; i < 16; i++) {
+ for (j = 0; j < 8; j++) {
+ if (x[i] & BIT(7 - j)) {
+ /* Z_(i + 1) = Z_i XOR V_i */
+ xor_block(z, v);
+ } else {
+ /* Z_(i + 1) = Z_i */
+ }
+
+ if (v[15] & 0x01) {
+ /* V_(i + 1) = (V_i >> 1) XOR R */
+ shift_right_block(v);
+ /* R = 11100001 || 0^120 */
+ v[0] ^= 0xe1;
+ } else {
+ /* V_(i + 1) = V_i >> 1 */
+ shift_right_block(v);
+ }
+ }
+ }
+}
+
+
+static void ghash_start(u8 *y)
+{
+ /* Y_0 = 0^128 */
+ os_memset(y, 0, 16);
+}
+
+
+static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
+{
+ size_t m, i;
+ const u8 *xpos = x;
+ u8 tmp[16];
+
+ m = xlen / 16;
+
+ for (i = 0; i < m; i++) {
+ /* Y_i = (Y^(i-1) XOR X_i) dot H */
+ xor_block(y, xpos);
+ xpos += 16;
+
+ /* dot operation:
+ * multiplication operation for binary Galois (finite) field of
+ * 2^128 elements */
+ gf_mult(y, h, tmp);
+ os_memcpy(y, tmp, 16);
+ }
+
+ if (x + xlen > xpos) {
+ /* Add zero padded last block */
+ size_t last = x + xlen - xpos;
+ os_memcpy(tmp, xpos, last);
+ os_memset(tmp + last, 0, sizeof(tmp) - last);
+
+ /* Y_i = (Y^(i-1) XOR X_i) dot H */
+ xor_block(y, tmp);
+
+ /* dot operation:
+ * multiplication operation for binary Galois (finite) field of
+ * 2^128 elements */
+ gf_mult(y, h, tmp);
+ os_memcpy(y, tmp, 16);
+ }
+
+ /* Return Y_m */
+}
+
+
+static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
+{
+ size_t i, n, last;
+ u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
+ const u8 *xpos = x;
+ u8 *ypos = y;
+
+ if (xlen == 0)
+ return;
+
+ n = xlen / 16;
+
+ os_memcpy(cb, icb, AES_BLOCK_SIZE);
+ /* Full blocks */
+ for (i = 0; i < n; i++) {
+ aes_encrypt(aes, cb, ypos);
+ xor_block(ypos, xpos);
+ xpos += AES_BLOCK_SIZE;
+ ypos += AES_BLOCK_SIZE;
+ inc32(cb);
+ }
+
+ last = x + xlen - xpos;
+ if (last) {
+ /* Last, partial block */
+ aes_encrypt(aes, cb, tmp);
+ for (i = 0; i < last; i++)
+ *ypos++ = *xpos++ ^ tmp[i];
+ }
+}
+
+
+/**
+ * aes_128_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
+ */
+int aes_128_gcm_ae(const u8 *key, const u8 *iv,
+ const u8 *plain, size_t plain_len,
+ const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
+{
+ u8 H[AES_BLOCK_SIZE];
+ u8 J0[AES_BLOCK_SIZE];
+ u8 S[16], len_buf[16];
+ void *aes;
+ size_t iv_len = 12;
+
+ aes = aes_encrypt_init(key, 16);
+ if (aes == NULL)
+ return -1;
+
+ /* 1. Generate hash subkey H = AES_K(0^128) */
+ os_memset(H, 0, sizeof(H));
+ aes_encrypt(aes, H, H);
+ wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
+
+ /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
+ os_memcpy(J0, iv, iv_len);
+ os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
+ J0[AES_BLOCK_SIZE - 1] = 0x01;
+
+ /* 3. C = GCTR_K(inc_32(J_0), P) */
+ inc32(J0);
+ aes_gctr(aes, J0, plain, plain_len, crypt);
+
+ /*
+ * 4. u = 128 * ceil[len(C)/128] - len(C)
+ * v = 128 * ceil[len(A)/128] - len(A)
+ * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
+ * (i.e., zero padded to block size A || C and lengths of each in bits)
+ */
+ ghash_start(S);
+ ghash(H, aad, aad_len, S);
+ ghash(H, crypt, plain_len, S);
+ WPA_PUT_BE64(len_buf, aad_len * 8);
+ WPA_PUT_BE64(len_buf + 8, plain_len * 8);
+ ghash(H, len_buf, sizeof(len_buf), S);
+
+ wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+
+ /* 6. T = MSB_t(GCTR_K(J_0, S)) */
+ J0[AES_BLOCK_SIZE - 1] = 0x01;
+ aes_gctr(aes, J0, S, sizeof(S), tag);
+
+ /* 7. Return (C, T) */
+
+ aes_encrypt_deinit(aes);
+
+ return 0;
+}
+
+
+/**
+ * aes_128_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
+ */
+int aes_128_gcm_ad(const u8 *key, const u8 *iv,
+ const u8 *crypt, size_t crypt_len,
+ const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
+{
+ u8 H[AES_BLOCK_SIZE];
+ u8 J0[AES_BLOCK_SIZE];
+ u8 S[16], T[16], len_buf[16];
+ void *aes;
+ size_t iv_len = 12;
+
+ aes = aes_encrypt_init(key, 16);
+ if (aes == NULL)
+ return -1;
+
+ /* 2. Generate hash subkey H = AES_K(0^128) */
+ os_memset(H, 0, sizeof(H));
+ aes_encrypt(aes, H, H);
+ wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
+
+ /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
+ os_memcpy(J0, iv, iv_len);
+ os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
+ J0[AES_BLOCK_SIZE - 1] = 0x01;
+
+ /* 4. C = GCTR_K(inc_32(J_0), C) */
+ inc32(J0);
+ aes_gctr(aes, J0, crypt, crypt_len, plain);
+
+ /*
+ * 5. u = 128 * ceil[len(C)/128] - len(C)
+ * v = 128 * ceil[len(A)/128] - len(A)
+ * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
+ * (i.e., zero padded to block size A || C and lengths of each in bits)
+ */
+ ghash_start(S);
+ ghash(H, aad, aad_len, S);
+ ghash(H, crypt, crypt_len, S);
+ WPA_PUT_BE64(len_buf, aad_len * 8);
+ WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
+ ghash(H, len_buf, sizeof(len_buf), S);
+
+ wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+
+ /* 7. T' = MSB_t(GCTR_K(J_0, S)) */
+ J0[AES_BLOCK_SIZE - 1] = 0x01;
+ aes_gctr(aes, J0, S, sizeof(S), T);
+
+ aes_encrypt_deinit(aes);
+
+ if (os_memcmp(tag, T, 16) != 0) {
+ wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
+ return -1;
+ }
+
+ return 0;
+}
#include "utils/common.h"
#include "common/ieee802_11_defs.h"
#include "crypto/aes.h"
+#include "crypto/aes_wrap.h"
#include "wlantest.h"
-static void inc32(u8 *block)
-{
- u32 val;
- val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
- val++;
- WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
-}
-
-
-static void xor_block(u8 *dst, const u8 *src)
-{
- u32 *d = (u32 *) dst;
- u32 *s = (u32 *) src;
- *d++ ^= *s++;
- *d++ ^= *s++;
- *d++ ^= *s++;
- *d++ ^= *s++;
-}
-
-
-static void shift_right_block(u8 *v)
-{
- u32 val;
-
- val = WPA_GET_BE32(v + 12);
- val >>= 1;
- if (v[11] & 0x01)
- val |= 0x80000000;
- WPA_PUT_BE32(v + 12, val);
-
- val = WPA_GET_BE32(v + 8);
- val >>= 1;
- if (v[7] & 0x01)
- val |= 0x80000000;
- WPA_PUT_BE32(v + 8, val);
-
- val = WPA_GET_BE32(v + 4);
- val >>= 1;
- if (v[3] & 0x01)
- val |= 0x80000000;
- WPA_PUT_BE32(v + 4, val);
-
- val = WPA_GET_BE32(v);
- val >>= 1;
- WPA_PUT_BE32(v, val);
-}
-
-
-/* Multiplication in GF(2^128) */
-static void gf_mult(const u8 *x, const u8 *y, u8 *z)
-{
- u8 v[16];
- int i, j;
-
- os_memset(z, 0, 16); /* Z_0 = 0^128 */
- os_memcpy(v, y, 16); /* V_0 = Y */
-
- for (i = 0; i < 16; i++) {
- for (j = 0; j < 8; j++) {
- if (x[i] & BIT(7 - j)) {
- /* Z_(i + 1) = Z_i XOR V_i */
- xor_block(z, v);
- } else {
- /* Z_(i + 1) = Z_i */
- }
-
- if (v[15] & 0x01) {
- /* V_(i + 1) = (V_i >> 1) XOR R */
- shift_right_block(v);
- /* R = 11100001 || 0^120 */
- v[0] ^= 0xe1;
- } else {
- /* V_(i + 1) = V_i >> 1 */
- shift_right_block(v);
- }
- }
- }
-}
-
-
-static void ghash_start(u8 *y)
-{
- /* Y_0 = 0^128 */
- os_memset(y, 0, 16);
-}
-
-
-static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
-{
- size_t m, i;
- const u8 *xpos = x;
- u8 tmp[16];
-
- m = xlen / 16;
-
- for (i = 0; i < m; i++) {
- /* Y_i = (Y^(i-1) XOR X_i) dot H */
- xor_block(y, xpos);
- xpos += 16;
-
- /* dot operation:
- * multiplication operation for binary Galois (finite) field of
- * 2^128 elements */
- gf_mult(y, h, tmp);
- os_memcpy(y, tmp, 16);
- }
-
- if (x + xlen > xpos) {
- /* Add zero padded last block */
- size_t last = x + xlen - xpos;
- os_memcpy(tmp, xpos, last);
- os_memset(tmp + last, 0, sizeof(tmp) - last);
-
- /* Y_i = (Y^(i-1) XOR X_i) dot H */
- xor_block(y, tmp);
-
- /* dot operation:
- * multiplication operation for binary Galois (finite) field of
- * 2^128 elements */
- gf_mult(y, h, tmp);
- os_memcpy(y, tmp, 16);
- }
-
- /* Return Y_m */
-}
-
-
-static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
-{
- size_t i, n, last;
- u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
- const u8 *xpos = x;
- u8 *ypos = y;
-
- if (xlen == 0)
- return;
-
- n = xlen / 16;
-
- os_memcpy(cb, icb, AES_BLOCK_SIZE);
- /* Full blocks */
- for (i = 0; i < n; i++) {
- aes_encrypt(aes, cb, ypos);
- xor_block(ypos, xpos);
- xpos += AES_BLOCK_SIZE;
- ypos += AES_BLOCK_SIZE;
- inc32(cb);
- }
-
- last = x + xlen - xpos;
- if (last) {
- /* Last, partial block */
- aes_encrypt(aes, cb, tmp);
- for (i = 0; i < last; i++)
- *ypos++ = *xpos++ ^ tmp[i];
- }
-}
-
-
-/**
- * aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
- */
-static int aes_gcm_ae(const u8 *key, const u8 *iv,
- const u8 *plain, size_t plain_len,
- const u8 *aad, size_t aad_len,
- u8 *crypt, u8 *tag)
-{
- u8 H[AES_BLOCK_SIZE];
- u8 J0[AES_BLOCK_SIZE];
- u8 S[16], len_buf[16];
- void *aes;
- size_t iv_len = 12;
-
- aes = aes_encrypt_init(key, 16);
- if (aes == NULL)
- return -1;
-
- /* 1. Generate hash subkey H = AES_K(0^128) */
- os_memset(H, 0, sizeof(H));
- aes_encrypt(aes, H, H);
- wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
-
- /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
- os_memcpy(J0, iv, iv_len);
- os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
- J0[AES_BLOCK_SIZE - 1] = 0x01;
-
- /* 3. C = GCTR_K(inc_32(J_0), P) */
- inc32(J0);
- aes_gctr(aes, J0, plain, plain_len, crypt);
-
- /*
- * 4. u = 128 * ceil[len(C)/128] - len(C)
- * v = 128 * ceil[len(A)/128] - len(A)
- * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
- * (i.e., zero padded to block size A || C and lengths of each in bits)
- */
- ghash_start(S);
- ghash(H, aad, aad_len, S);
- ghash(H, crypt, plain_len, S);
- WPA_PUT_BE64(len_buf, aad_len * 8);
- WPA_PUT_BE64(len_buf + 8, plain_len * 8);
- ghash(H, len_buf, sizeof(len_buf), S);
-
- wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
-
- /* 6. T = MSB_t(GCTR_K(J_0, S)) */
- J0[AES_BLOCK_SIZE - 1] = 0x01;
- aes_gctr(aes, J0, S, sizeof(S), tag);
-
- /* 7. Return (C, T) */
-
- aes_encrypt_deinit(aes);
-
- return 0;
-}
-
-
-/**
- * aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
- */
-static int aes_gcm_ad(const u8 *key, const u8 *iv,
- const u8 *crypt, size_t crypt_len,
- const u8 *aad, size_t aad_len, const u8 *tag,
- u8 *plain)
-{
- u8 H[AES_BLOCK_SIZE];
- u8 J0[AES_BLOCK_SIZE];
- u8 S[16], T[16], len_buf[16];
- void *aes;
- size_t iv_len = 12;
-
- aes = aes_encrypt_init(key, 16);
- if (aes == NULL)
- return -1;
-
- /* 2. Generate hash subkey H = AES_K(0^128) */
- os_memset(H, 0, sizeof(H));
- aes_encrypt(aes, H, H);
- wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
-
- /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
- os_memcpy(J0, iv, iv_len);
- os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
- J0[AES_BLOCK_SIZE - 1] = 0x01;
-
- /* 4. C = GCTR_K(inc_32(J_0), C) */
- inc32(J0);
- aes_gctr(aes, J0, crypt, crypt_len, plain);
-
- /*
- * 5. u = 128 * ceil[len(C)/128] - len(C)
- * v = 128 * ceil[len(A)/128] - len(A)
- * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
- * (i.e., zero padded to block size A || C and lengths of each in bits)
- */
- ghash_start(S);
- ghash(H, aad, aad_len, S);
- ghash(H, crypt, crypt_len, S);
- WPA_PUT_BE64(len_buf, aad_len * 8);
- WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
- ghash(H, len_buf, sizeof(len_buf), S);
-
- wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
-
- /* 7. T' = MSB_t(GCTR_K(J_0, S)) */
- J0[AES_BLOCK_SIZE - 1] = 0x01;
- aes_gctr(aes, J0, S, sizeof(S), T);
-
- aes_encrypt_deinit(aes);
-
- if (os_memcmp(tag, T, 16) != 0) {
- wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
- return -1;
- }
-
- return 0;
-}
-
-
static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data,
u8 *aad, size_t *aad_len, u8 *nonce)
{
wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
- if (aes_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) <
+ if (aes_128_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) <
0) {
u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR
wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
- if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len,
+ if (aes_128_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len,
pos, pos + plen) < 0) {
os_free(crypt);
return NULL;
projects / thirdparty / hostap.git / commitdiff
